News for hackers. Stuff that matters.

A comment on Using two-factor authentication for SSH.

Re:Using two-factor authentication for SSH by newman314 on Tuesday January 12, 2016 @04:31PM (#10890544)
Using 2FA is all well and good but what I haven't found is a good solution for managing ssh keys for an organization/group. Would love to get some recommendations here.
[ Parent | on HN ]
Re:Using two-factor authentication for SSH by lrvick on Tuesday January 12, 2016 @04:37PM (#10890574)
I tend to store authorized ssh public keys in a database then configure all servers with the appropriate AuthorizedKeysCommand in sshd_config to fetch them on the fly.

I also tend to include some form of caching in case the connection to the database is broken.

With this I can maintain keys for an entire cluster centrally.

This is all in place with open source configuration and tooling on https://hashbang.sh (https://github.com/hashbang). It is implemented with LDAP+sssd there. Feel free to pop in as we love discussing this stuff.

We have done similar with etcd as the backing database at my employer.

[ Parent | on HN ]
Re:Using two-factor authentication for SSH by lrvick on Tuesday January 12, 2016 @04:38PM (#10890584)
Worth noting: In both cases all keys with admin access are in fact GPG Authentication subkeys stored in smartcards each admin carries on their person.
[ Parent | on HN ]